Appeals Court Says Netflix Doesn't Violate Privacy By Displaying Viewing History To Anyone Using That Account

from the because-duh dept

The Ninth Circuit Appeals Court has upheld a win for Netflix in yet another privacy class-action lawsuit arising from the publication of then-Supreme Court nominee Robert Bork's rental history oh so many years ago. The Video Privacy Protection Act sprang into being in 1988 and was used to extract a settlement from Netflix over 20 years later.

The lawsuit Netflix settled featured one key difference: in that case, rental information -- in the form of "anonymized data" -- was released to third parties working on better suggestion algorithms in hopes of winning $1 million. In this case, no information was released in any form to third parties… at least not in this sense.

At the center of this lawsuit were complaints that Netflix exposed viewing history to certain third parties, i.e., anyone who used the same login as the account holder. This would include family, friends and guests at a person's residence. Since Netflix allows any number of devices to be allowed to access the account simultaneously (depending on how much you want to pay per month), one person's viewing history could theoretically be accessed by a great many people.

So, while there may be a privacy concern, it isn't a logical one. The information "exposed" to third parties is done so willingly by the account holder by sharing login info/logged-in devices with other viewers. Certainly the original account holder would like immediate access to recently viewed content. But this convenience also allows anyone using that login to see what's been viewed by that account. The plaintiffs claimed this convenient feature was actually a violation of the 27-year-old Video Privacy Protection Act.

The complaint alleges that upon setting up a Netflix account, personally identifiable information, by default, is only disclosed to a Netflix subscriber through her password-protected account. Under those circumstances, a subscriber’s queue or recommendation lists are only viewable by the subscriber. Netflix subscribers can then elect to display on their televisions what would otherwise be password-protected information by registering Netflix-ready devices in their accounts. Thereafter, Netflix automatically displays on a television what it displays on a subscriber’s computer: streamed instant videos, the subscriber’s queue, and video recommendations. This is plainly a disclosure “to the consumer” as contemplated by the VPPA. When Netflix displays a subscriber’s queue, viewing history, or recommendation lists in her online account, that is a disclosure directly to the consumer. The nature of that disclosure does not change when subscribers choose to display the same content on their television screens. The subscriber’s choice to do so does not trigger some new statutory duty on the part of Netflix.
Furthermore, the law (logically) does not demand that Netflix prevent things it can't possibly control.
The fact that a subscriber may permit third parties to access her account, thereby allowing third parties to view Netflix’s disclosures, does not alter the legal status of those disclosures. No matter the particular circumstances at a subscriber’s residence, Netflix’s actions remain the same: it transmits information automatically to the device that a subscriber connected to her Netflix account. The lawfulness of this disclosure cannot depend on circumstances outside of Netflix’s control.
The lawsuit also used California's civil code as a fallback option in case the VPPA claims failed, but the court finds the wording in that statute doesn't open Netflix up to any additional culpability.
While phrased in slightly different language than the VPPA, the California Civil Code plainly excludes liability for disclosures to a subscriber who is the subject of a record. Netflix’s disclosure of personal information was made to its subscribers and therefore it is not liable under section 1799.3.
That this case made it as far as the appeals court is simply the judicial system functioning as it should, rather than indicative of the lawsuit's strengths. Exhausting every available remedy is something the system grants to plaintiffs, even if the arguments made are incredibly weak.

The simple fact is that if someone don't want anyone but Netflix knowing what they watch, they should't let anyone but Netflix have access to the account. Additionally, the company now allows the account holder to remove recently-viewed titles at any point in time (exception: children's accounts). Granted, this feature didn't go into effect until after the lawsuit was filed, but its nonexistence at the point of filing (2011) didn't make the lawsuit any less misguided. Information pertinent and relevant to the account holder will obviously be displayed to any person using any device that is logged on to that account. Why anyone should expect anything else when they "log in" is baffling.

Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: privacy, video rentals, videos, vppa
Companies: netflix


Reader Comments

Subscribe: RSS

View by: Time | Thread


  1. icon
    mr. sim (profile), 3 Aug 2015 @ 4:13pm

    you know i'm not a lawyer but why doesn't the court require a client to use common sense before a lawyer can file a case on their behalf?

    link to this | view in thread ]

  2. identicon
    Nigel, 3 Aug 2015 @ 4:34pm

    Wake me up when netflix hosts midget porn.

    link to this | view in thread ]

  3. identicon
    Anonymous Coward, 3 Aug 2015 @ 4:36pm

    Re:

    Drop in billable hours... applying common sense BEFORE the lawyer charged their client would result in at least a 50% reduction in billable hours.

    You want to sue those kids on your lawn... we can do that
    You want to sue that cloud where all your data is... we can do that
    You want to sue mother nature for raining on your parade... we can do that

    Lawyers are willing to do just about anything to rack up the billable hours... want to jump the shark, they can do that

    link to this | view in thread ]

  4. icon
    norahc (profile), 3 Aug 2015 @ 5:02pm

    Speaking of which....

    I wonder why somebody didn't use the VPPA against Malibu Media for their infamous Exhibit C,

    link to this | view in thread ]

  5. icon
    Kal Zekdor (profile), 3 Aug 2015 @ 5:29pm

    I still have that data...

    The lawsuit Netflix settled featured one key difference: in that case, rental information -- in the form of "anonymized data" -- was released to third parties working on better suggestion algorithms in hopes of winning $1 million.

    Huh. I actually participated in that contest. Did fairly well, I had ~82% accuracy on the test set. Not bad for a college kid at the time, though of course the winner was some big lab. My biggest problem was a lack of compute power. Had to rewrite my algorithm to use aggressive disk caching, 'cause the 6gb of RAM on my server wasn't nearly enough. Slowed the whole thing to a crawl, so that even the smaller training set took like 12 hours to process. This was, of course, before SSDs were economically feasible.

    I'm pretty sure that I still have a copy of that data lying around.

    link to this | view in thread ]

  6. identicon
    Anonymous Coward, 4 Aug 2015 @ 1:08am

    Uh.... keep your password to yourself I guess.
    What? Did they expect Netflix to support multiple profiles per account with face recognition now !?

    link to this | view in thread ]

  7. identicon
    Anonymous Coward, 4 Aug 2015 @ 2:08am

    If multiple people use an account, then the viewing history reflects the viewing habits of multiple people. The account owner is violating the privacy of other accounts users!

    link to this | view in thread ]

  8. icon
    MALLEYLAW@GMAIL.COM (profile), 4 Aug 2015 @ 5:58am

    Re: Re:

    Defense attys are paid whether the case is won or lost. Plaintiff attys, those representing individuals suing, are only paid if the client wins. These lawyers probably lost $200.000 in lower court and $100.000 at appeals ct.

    link to this | view in thread ]

  9. icon
    MALLEYLAW@GMAIL.COM (profile), 4 Aug 2015 @ 6:00am

    Re: Speaking of which....

    Interesting point, but VPPA concerns subscribers. Malibu's argument is unauthorized access.

    link to this | view in thread ]

  10. icon
    MALLEYLAW@GMAIL.COM (profile), 4 Aug 2015 @ 6:01am

    Re:

    I'm a lawyer and I agree

    link to this | view in thread ]

  11. icon
    MALLEYLAW@GMAIL.COM (profile), 4 Aug 2015 @ 6:05am

    Re: I still have that data...

    http://www.wired.com/2009/12/netflix-privacy-lawsuit/

    "The lead attorney on the new suit, Joseph Malley, recently reached a multimillion-dollar settlement with Facebook over its failed Beacon program, which drew fire in part for sharing users’ Blockbuster rentals with their friends."

    Interesting. Were you ever contacted to return the data?

    link to this | view in thread ]

  12. identicon
    JEDIDIAH, 4 Aug 2015 @ 12:06pm

    The law is no good unless you actually use it...

    There actually is a process for this. It's called summary judgement.

    Like many things in the law, the solution is already there. You just have to bother using it rather than attempting to create new (an possibly more bothersome) measures.

    link to this | view in thread ]

  13. identicon
    JEDIDIAH, 4 Aug 2015 @ 12:08pm

    Is this for real?

    In that case the account holder is a group entity and nothing is being disclosed to anyone but the account holder.

    If you don't want your wife to know that you watch midget porn then don't watch midget porn with the family Netflix account.

    link to this | view in thread ]

  14. identicon
    Anonymous Coward, 4 Aug 2015 @ 5:20pm

    Re:

    I have two profiles setup on netflix. One in my name one just labelled kids. It was a good idea...

    Of course not all the machines in the house have the ability to use the sub second profile soooo my profile is full of little girl cartoons and the kids can see a list of every movie the wife and I have watched.

    link to this | view in thread ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.